forked from net-ssh/net-ssh
/
test_algorithms.rb
328 lines (267 loc) · 16.7 KB
/
test_algorithms.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
require 'common'
require 'net/ssh/transport/algorithms'
module Transport
class TestAlgorithms < Test::Unit::TestCase
include Net::SSH::Transport::Constants
def test_allowed_packets
(0..255).each do |type|
packet = stub("packet", :type => type)
case type
when 1..4, 6..19, 21..49 then assert(Net::SSH::Transport::Algorithms.allowed_packet?(packet), "#{type} should be allowed during key exchange")
else assert(!Net::SSH::Transport::Algorithms.allowed_packet?(packet), "#{type} should not be allowed during key exchange")
end
end
end
def test_constructor_should_build_default_list_of_preferred_algorithms
assert_equal %w(ssh-rsa ssh-dss ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com)+ec_host_keys, algorithms[:host_key]
assert_equal %w(diffie-hellman-group-exchange-sha1 diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha256)+ec_kex, algorithms[:kex]
assert_equal %w(aes128-cbc 3des-cbc blowfish-cbc cast128-cbc aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se idea-cbc none arcfour128 arcfour256 arcfour aes128-ctr aes192-ctr aes256-ctr cast128-ctr blowfish-ctr 3des-ctr), algorithms[:encryption]
if defined?(OpenSSL::Digest::SHA256)
assert_equal %w(hmac-sha1 hmac-md5 hmac-sha1-96 hmac-md5-96 hmac-ripemd160 hmac-ripemd160@openssh.com hmac-sha2-256 hmac-sha2-512 hmac-sha2-256-96 hmac-sha2-512-96 none), algorithms[:hmac]
else
assert_equal %w(hmac-sha1 hmac-md5 hmac-sha1-96 hmac-md5-96 hmac-ripemd160 hmac-ripemd160@openssh.com none umac-128-etm@openssh.com), algorithms[:hmac] end
assert_equal %w(none zlib@openssh.com zlib), algorithms[:compression]
assert_equal %w(), algorithms[:language]
end
def test_constructor_should_set_client_and_server_prefs_identically
%w(encryption hmac compression language).each do |key|
assert_equal algorithms[key.to_sym], algorithms[:"#{key}_client"], key
assert_equal algorithms[key.to_sym], algorithms[:"#{key}_server"], key
end
end
def test_constructor_with_preferred_host_key_type_should_put_preferred_host_key_type_first
assert_equal %w(ssh-dss ssh-rsa ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com)+ec_host_keys, algorithms(:host_key => "ssh-dss", :append_all_supported_algorithms => true)[:host_key]
end
def test_constructor_with_known_hosts_reporting_known_host_key_should_use_that_host_key_type
Net::SSH::KnownHosts.expects(:search_for).with("net.ssh.test,127.0.0.1", {}).returns([stub("key", :ssh_type => "ssh-dss")])
assert_equal %w(ssh-dss ssh-rsa ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com )+ec_host_keys, algorithms[:host_key]
end
def ec_host_keys
if defined?(OpenSSL::PKey::EC)
%w(ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521)
else
[]
end
end
def test_constructor_with_unrecognized_host_key_type_should_return_whats_supported
assert_equal %w(ssh-rsa ssh-dss ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com )+ec_host_keys, algorithms(:host_key => "bogus ssh-rsa",:append_all_supported_algorithms => true)[:host_key]
end
def ec_kex
if defined?(OpenSSL::PKey::EC)
%w(ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521)
else
[]
end
end
def test_constructor_with_preferred_kex_should_put_preferred_kex_first
assert_equal %w(diffie-hellman-group1-sha1 diffie-hellman-group-exchange-sha1 diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha256)+ec_kex, algorithms(:kex => "diffie-hellman-group1-sha1", :append_all_supported_algorithms => true)[:kex]
end
def test_constructor_with_unrecognized_kex_should_not_raise_exception
assert_equal %w(diffie-hellman-group1-sha1 diffie-hellman-group-exchange-sha1 diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha256)+ec_kex, algorithms(
:kex => %w(bogus diffie-hellman-group1-sha1),:append_all_supported_algorithms => true)[:kex]
end
def test_constructor_with_preferred_encryption_should_put_preferred_encryption_first
assert_equal %w(aes256-cbc aes128-cbc 3des-cbc blowfish-cbc cast128-cbc aes192-cbc rijndael-cbc@lysator.liu.se idea-cbc none arcfour128 arcfour256 arcfour aes128-ctr aes192-ctr aes256-ctr cast128-ctr blowfish-ctr 3des-ctr), algorithms(:encryption => "aes256-cbc",
:append_all_supported_algorithms => true)[:encryption]
end
def test_constructor_with_multiple_preferred_encryption_should_put_all_preferred_encryption_first
assert_equal %w(aes256-cbc 3des-cbc idea-cbc aes128-cbc blowfish-cbc cast128-cbc aes192-cbc rijndael-cbc@lysator.liu.se none arcfour128 arcfour256 arcfour aes128-ctr aes192-ctr aes256-ctr cast128-ctr blowfish-ctr 3des-ctr), algorithms(:encryption => %w(aes256-cbc 3des-cbc idea-cbc), :append_all_supported_algorithms => true)[:encryption]
end
def test_constructor_with_unrecognized_encryption_should_keep_whats_supported
assert_equal %w(aes256-cbc aes128-cbc 3des-cbc blowfish-cbc cast128-cbc aes192-cbc rijndael-cbc@lysator.liu.se idea-cbc none arcfour128 arcfour256 arcfour aes128-ctr aes192-ctr aes256-ctr cast128-ctr blowfish-ctr 3des-ctr), algorithms(:encryption => %w(bogus aes256-cbc), :append_all_supported_algorithms => true)[:encryption]
end
def test_constructor_with_preferred_hmac_should_put_preferred_hmac_first
assert_equal %w(hmac-md5-96 hmac-sha1 hmac-md5 hmac-sha1-96 hmac-ripemd160 hmac-ripemd160@openssh.com hmac-sha2-256 hmac-sha2-512 hmac-sha2-256-96 hmac-sha2-512-96 none), algorithms(:hmac => "hmac-md5-96", :append_all_supported_algorithms => true)[:hmac]
end
def test_constructor_with_multiple_preferred_hmac_should_put_all_preferred_hmac_first
assert_equal %w(hmac-md5-96 hmac-sha1-96 hmac-sha1 hmac-md5 hmac-ripemd160 hmac-ripemd160@openssh.com hmac-sha2-256 hmac-sha2-512 hmac-sha2-256-96 hmac-sha2-512-96 none), algorithms(:hmac => %w(hmac-md5-96 hmac-sha1-96), :append_all_supported_algorithms => true)[:hmac]
end
def test_constructor_with_unrecognized_hmac_should_ignore_those
assert_equal %w(hmac-md5-96 hmac-sha1 hmac-md5 hmac-sha1-96 hmac-ripemd160 hmac-ripemd160@openssh.com hmac-sha2-256 hmac-sha2-512 hmac-sha2-256-96 hmac-sha2-512-96 none),
algorithms(:hmac => "hmac-md5-96", :append_all_supported_algorithms => true)[:hmac]
end
def test_constructor_with_preferred_compression_should_put_preferred_compression_first
assert_equal %w(zlib none zlib@openssh.com), algorithms(:compression => "zlib", :append_all_supported_algorithms => true)[:compression]
end
def test_constructor_with_multiple_preferred_compression_should_put_all_preferred_compression_first
assert_equal %w(zlib@openssh.com zlib none), algorithms(:compression => %w(zlib@openssh.com zlib),
:append_all_supported_algorithms => true)[:compression]
end
def test_constructor_with_general_preferred_compression_should_put_none_last
assert_equal %w(zlib@openssh.com zlib none), algorithms(
:compression => true, :append_all_supported_algorithms => true)[:compression]
end
def test_constructor_with_unrecognized_compression_should_return_whats_supported
assert_equal %w(none zlib zlib@openssh.com), algorithms(:compression => %w(bogus none zlib), :append_all_supported_algorithms => true)[:compression]
end
def test_initial_state_should_be_neither_pending_nor_initialized
assert !algorithms.pending?
assert !algorithms.initialized?
end
def test_key_exchange_when_initiated_by_server
transport.expect do |t, buffer|
assert_kexinit(buffer)
install_mock_key_exchange(buffer)
end
install_mock_algorithm_lookups
algorithms.accept_kexinit(kexinit)
assert_exchange_results
end
def test_key_exchange_when_initiated_by_client
state = nil
transport.expect do |t, buffer|
assert_kexinit(buffer)
state = :sent_kexinit
install_mock_key_exchange(buffer)
end
algorithms.rekey!
assert_equal state, :sent_kexinit
assert algorithms.pending?
install_mock_algorithm_lookups
algorithms.accept_kexinit(kexinit)
assert_exchange_results
end
def test_key_exchange_when_server_does_not_support_preferred_kex_should_fallback_to_secondary
kexinit :kex => "diffie-hellman-group1-sha1"
transport.expect do |t,buffer|
assert_kexinit(buffer)
install_mock_key_exchange(buffer, :kex => Net::SSH::Transport::Kex::DiffieHellmanGroup1SHA1)
end
algorithms.accept_kexinit(kexinit)
end
def test_key_exchange_when_server_does_not_support_any_preferred_kex_should_raise_error
kexinit :kex => "something-obscure"
transport.expect { |t,buffer| assert_kexinit(buffer) }
assert_raises(Net::SSH::Exception) { algorithms.accept_kexinit(kexinit) }
end
def test_allow_when_not_pending_should_be_true_for_all_packets
(0..255).each do |type|
packet = stub("packet", :type => type)
assert algorithms.allow?(packet), type.to_s
end
end
def test_allow_when_pending_should_be_true_only_for_packets_valid_during_key_exchange
transport.expect!
algorithms.rekey!
assert algorithms.pending?
(0..255).each do |type|
packet = stub("packet", :type => type)
case type
when 1..4, 6..19, 21..49 then assert(algorithms.allow?(packet), "#{type} should be allowed during key exchange")
else assert(!algorithms.allow?(packet), "#{type} should not be allowed during key exchange")
end
end
end
def test_exchange_with_zlib_compression_enabled_sets_compression_to_standard
algorithms :compression => "zlib", :append_all_supported_algorithms => true
transport.expect do |t, buffer|
assert_kexinit(buffer, :compression_client => "zlib,none,zlib@openssh.com", :compression_server => "zlib,none,zlib@openssh.com")
install_mock_key_exchange(buffer)
end
install_mock_algorithm_lookups
algorithms.accept_kexinit(kexinit)
assert_equal :standard, transport.client_options[:compression]
assert_equal :standard, transport.server_options[:compression]
end
def test_exchange_with_zlib_at_openssh_dot_com_compression_enabled_sets_compression_to_delayed
algorithms :compression => "zlib@openssh.com", :append_all_supported_algorithms => true
transport.expect do |t, buffer|
assert_kexinit(buffer, :compression_client => "zlib@openssh.com,none,zlib", :compression_server => "zlib@openssh.com,none,zlib")
install_mock_key_exchange(buffer)
end
install_mock_algorithm_lookups
algorithms.accept_kexinit(kexinit)
assert_equal :delayed, transport.client_options[:compression]
assert_equal :delayed, transport.server_options[:compression]
end
private
def install_mock_key_exchange(buffer, options={})
kex = options[:kex] || Net::SSH::Transport::Kex::DiffieHellmanGroupExchangeSHA1
Net::SSH::Transport::Kex::MAP.each do |name, klass|
next if klass == kex
klass.expects(:new).never
end
kex.expects(:new).
with(algorithms, transport,
:client_version_string => Net::SSH::Transport::ServerVersion::PROTO_VERSION,
:server_version_string => transport.server_version.version,
:server_algorithm_packet => kexinit.to_s,
:client_algorithm_packet => buffer.to_s,
:need_bytes => 20,
:logger => nil).
returns(stub("kex", :exchange_keys => { :shared_secret => shared_secret, :session_id => session_id, :hashing_algorithm => hashing_algorithm }))
end
def install_mock_algorithm_lookups(options={})
params = { :shared => shared_secret.to_ssh, :hash => session_id, :digester => hashing_algorithm }
Net::SSH::Transport::CipherFactory.expects(:get).
with(options[:client_cipher] || "aes128-cbc", params.merge(:iv => key("A"), :key => key("C"), :encrypt => true)).
returns(:client_cipher)
Net::SSH::Transport::CipherFactory.expects(:get).
with(options[:server_cipher] || "aes128-cbc", params.merge(:iv => key("B"), :key => key("D"), :decrypt => true)).
returns(:server_cipher)
Net::SSH::Transport::HMAC.expects(:get).with(options[:client_hmac] || "hmac-sha1", key("E"), params).returns(:client_hmac)
Net::SSH::Transport::HMAC.expects(:get).with(options[:server_hmac] || "hmac-sha1", key("F"), params).returns(:server_hmac)
end
def shared_secret
@shared_secret ||= OpenSSL::BN.new("1234567890", 10)
end
def session_id
@session_id ||= "this is the session id"
end
def hashing_algorithm
OpenSSL::Digest::SHA1
end
def key(salt)
hashing_algorithm.digest(shared_secret.to_ssh + session_id + salt + session_id)
end
def cipher(type, options={})
Net::SSH::Transport::CipherFactory.get(type, options)
end
def kexinit(options={})
@kexinit ||= P(:byte, KEXINIT,
:long, rand(0xFFFFFFFF), :long, rand(0xFFFFFFFF), :long, rand(0xFFFFFFFF), :long, rand(0xFFFFFFFF),
:string, options[:kex] || "diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256",
:string, options[:host_key] || "ssh-rsa,ssh-dss",
:string, options[:encryption_client] || "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,idea-cbc",
:string, options[:encryption_server] || "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,idea-cbc",
:string, options[:hmac_client] || "hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96",
:string, options[:hmac_server] || "hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96",
:string, options[:compression_client] || "none,zlib@openssh.com,zlib",
:string, options[:compression_server] || "none,zlib@openssh.com,zlib",
:string, options[:language_client] || "",
:string, options[:langauge_server] || "",
:bool, options[:first_kex_follows])
end
def assert_kexinit(buffer, options={})
assert_equal KEXINIT, buffer.type
assert_equal 16, buffer.read(16).length
assert_equal options[:kex] || (%w(diffie-hellman-group-exchange-sha1 diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha256)+ec_kex).join(','), buffer.read_string
assert_equal options[:host_key] || (%w(ssh-rsa ssh-dss ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com)+ec_host_keys).join(','), buffer.read_string
assert_equal options[:encryption_client] || "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,idea-cbc,none,arcfour128,arcfour256,arcfour,aes128-ctr,aes192-ctr,aes256-ctr,cast128-ctr,blowfish-ctr,3des-ctr", buffer.read_string
assert_equal options[:encryption_server] || "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,idea-cbc,none,arcfour128,arcfour256,arcfour,aes128-ctr,aes192-ctr,aes256-ctr,cast128-ctr,blowfish-ctr,3des-ctr", buffer.read_string
assert_equal options[:hmac_client] || "hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-96,hmac-sha2-512-96,none", buffer.read_string
assert_equal options[:hmac_server] || "hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-96,hmac-sha2-512-96,none", buffer.read_string
assert_equal options[:compression_client] || "none,zlib@openssh.com,zlib", buffer.read_string
assert_equal options[:compression_server] || "none,zlib@openssh.com,zlib", buffer.read_string
assert_equal options[:language_client] || "", buffer.read_string
assert_equal options[:language_server] || "", buffer.read_string
assert_equal options[:first_kex_follows] || false, buffer.read_bool
end
def assert_exchange_results
assert algorithms.initialized?
assert !algorithms.pending?
assert !transport.client_options[:compression]
assert !transport.server_options[:compression]
assert_equal :client_cipher, transport.client_options[:cipher]
assert_equal :server_cipher, transport.server_options[:cipher]
assert_equal :client_hmac, transport.client_options[:hmac]
assert_equal :server_hmac, transport.server_options[:hmac]
end
def algorithms(options={})
@algorithms ||= Net::SSH::Transport::Algorithms.new(transport, options)
end
def transport
@transport ||= MockTransport.new
end
end
end